{"id":"CVE-2026-106109","aliases":["EUVD-2026-93573","GHSA-q9mq-245r-4g93"],"status":"published","title":"Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories","description":"Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external directories. An unsafe trusted configuration can delete data writable by the build user before compilation begins. No attacker-controlled input reaches build.distDir by default, so exploitation requires compromised or less-trusted automation to influence build configuration, or a developer to run a mistaken configuration. This issue is fixed in version 3.3.0.","severity":{"version":"4.0","score":4.1,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00126,"percentile":0.02278,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22","CWE-73"],"published":"2026-10-06T17:32:08Z","modified":"2026-11-11T02:48:41Z","fixes":[{"ecosystem":"npm","package":"@quasar/app-vite","fixed_in":["3.3.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@quasar/app-vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"last_affected":"3.2.0"},{"fixed":"3.3.0"}]}]},{"source":"osv","ecosystem":"npm","package":"@quasar/app-vite","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"3.3.0"}]}]}],"products":[{"vendor":"@quasar","product":"app-vite"},{"vendor":"quasarframework","product":"quasar"}],"references":[{"url":"https://github.com/quasarframework/quasar/security/advisories/GHSA-q9mq-245r-4g93","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/quasarframework/quasar/commit/6c009734b406e246a0855ed060e3a822de8aecc1","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106109","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-q9mq-245r-4g93"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106109.json","tags":["advisory"]},{"url":"https://github.com/quasarframework/quasar","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-106109","title":"Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories","description":"Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external directories. An unsafe trusted configuration can delete data writable by the build user before compilation begins. No attacker-controlled input reaches build.distDir by default, so exploitation requires compromised or less-trusted automation to influence build configuration, or a developer to run a mistaken configuration. This issue is fixed in version 3.3.0.","status":"published","published":"2026-10-06T17:32:08.136Z","modified":"2026-10-06T19:43:35.076Z","cvss":[{"version":"4.0","score":4.1,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22","CWE-73"],"updated_at":"2026-11-02T14:20:04.156238Z"}],"euvd":[{"id":"EUVD-2026-93573","description":"Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external directories. An unsafe trusted configuration can delete data writable by the build user before compilation begins. No attacker-controlled input reaches build.distDir by default, so exploitation requires compromised or less-trusted automation to influence build configuration, or a developer to run a mistaken configuration. This issue is fixed in version 3.3.0.","status":"published","published":"2026-10-06T17:32:08Z","modified":"2026-10-06T19:43:35Z","cvss":[{"version":"4.0","score":4.1,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:27:36.701921Z"}],"ghsa":[{"id":"GHSA-q9mq-245r-4g93","title":"Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories","description":"## Summary\n\n`@quasar/app-vite` recursively removes `build.distDir` before producing build artifacts. The configured path was made absolute, but it was not checked before removal. A configuration mistake could therefore target the project root, user home directory, a filesystem root, or another directory outside the project.\n\n## Details\n\nThe build command and mode builders passed the resolved output directory directly to `fs-extra` recursive removal. Existing symlink ancestors were not resolved before deletion either, so a path that appeared to be inside the project could operate on a directory outside it.\n\n`quasar.config` is trusted application code, and no attacker-controlled input reaches `build.distDir` by default. This issue is primarily destructive-build safety hardening. It can become a security boundary when build configuration is generated or influenced by less-trusted automation.\n\n## Impact\n\nRunning a normal Quasar build with an unsafe `build.distDir` can delete data accessible to the build user before compilation begins.\n\n## Remediation\n\nValidate the effective deletion target before every artifact cleanup. Always reject filesystem roots, the user home directory and the project root; resolve existing symlink ancestors; require an explicit `build.allowOutsideProjectDistDir` opt-in for external output directories; and log the exact resolved target before removal.","status":"published","published":"2026-10-07T16:14:35Z","modified":"2026-10-07T16:14:36Z","cvss":[{"version":"4.0","score":4.1,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-22","CWE-73"],"updated_at":"2026-11-02T14:41:28.013673Z"}],"nvd":[{"id":"CVE-2026-106109","description":"Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external directories. An unsafe trusted configuration can delete data writable by the build user before compilation begins. No attacker-controlled input reaches build.distDir by default, so exploitation requires compromised or less-trusted automation to influence build configuration, or a developer to run a mistaken configuration. This issue is fixed in version 3.3.0.","status":"published","published":"2026-10-06T18:16:52.34Z","modified":"2026-10-06T20:17:17.473Z","cvss":[{"version":"4.0","score":4.1,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-22","CWE-73"],"updated_at":"2026-11-02T14:12:54.486849Z"}],"osv":[{"id":"CVE-2026-106109","title":"Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories","description":"Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external directories. An unsafe trusted configuration can delete data writable by the build user before compilation begins. No attacker-controlled input reaches build.distDir by default, so exploitation requires compromised or less-trusted automation to influence build configuration, or a developer to run a mistaken configuration. This issue is fixed in version 3.3.0.","status":"published","published":"2026-10-06T17:32:08.136Z","modified":"2026-11-11T10:47:23.805686526Z","cvss":[{"version":"4.0","score":4.1,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-22","CWE-73"],"updated_at":"2026-11-11T03:22:04.464623Z"},{"id":"GHSA-q9mq-245r-4g93","title":"Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories","description":"## Summary\n\n`@quasar/app-vite` recursively removes `build.distDir` before producing build artifacts. The configured path was made absolute, but it was not checked before removal. A configuration mistake could therefore target the project root, user home directory, a filesystem root, or another directory outside the project.\n\n## Details\n\nThe build command and mode builders passed the resolved output directory directly to `fs-extra` recursive removal. Existing symlink ancestors were not resolved before deletion either, so a path that appeared to be inside the project could operate on a directory outside it.\n\n`quasar.config` is trusted application code, and no attacker-controlled input reaches `build.distDir` by default. This issue is primarily destructive-build safety hardening. It can become a security boundary when build configuration is generated or influenced by less-trusted automation.\n\n## Impact\n\nRunning a normal Quasar build with an unsafe `build.distDir` can delete data accessible to the build user before compilation begins.\n\n## Remediation\n\nValidate the effective deletion target before every artifact cleanup. Always reject filesystem roots, the user home directory and the project root; resolve existing symlink ancestors; require an explicit `build.allowOutsideProjectDistDir` opt-in for external output directories; and log the exact resolved target before removal.","status":"published","published":"2026-10-07T16:14:35Z","modified":"2026-10-07T16:30:06.349887482Z","cvss":[{"version":"4.0","score":4.1,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-22","CWE-73"],"updated_at":"2026-11-02T15:46:54.40888Z"}]}}